Store the flag in the d3d9 structure. Again, see the way we handle IID_IDirect3DDevice9Ex in d3d9_device_QueryInterface().
The flag is no problem, but the arguments won't be passed into the d3d9 device. Where would you store D3D9ON12_ARGS *override_list and UINT override_entries? UINT sdk_version doesn't seem to be used anyway so that's not a problem.
What would you do in Direct3DCreate9On12?
You can implement a separate refcount without needing a separate object (just use a separate refcount field), although it's not clear we need to care.
This doesn't make sense to me. Are there examples of objects with more than one refcount? D3D9on12 is only created if the right arguments are passed to Direct3DCreate9On12. And it can be released independently of IDirect3DDevice9 so it should have its own refcount. Also, wouldn't it be better from a memory management perspective to handle it as a separate object?